app-sre
diff --git a/Diff for: ‎.ci-operator.yaml
+1-1 b/Diff for: ‎.ci-operator.yaml
+1-1
diff --git a/Diff for: ‎.codecov.yml
+4 b/Diff for: ‎.codecov.yml
+4
diff --git a/Diff for: ‎boilerplate/_data/backing-image-tag
+1-1 b/Diff for: ‎boilerplate/_data/backing-image-tag
+1-1
diff --git a/Diff for: ‎boilerplate/_data/last-boilerplate-commit
+1-1 b/Diff for: ‎boilerplate/_data/last-boilerplate-commit
+1-1
diff --git a/Diff for: ‎boilerplate/_lib/container-make
+9-6 b/Diff for: ‎boilerplate/_lib/container-make
+9-6
diff --git a/Diff for: ‎boilerplate/_lib/subscriber-propose
-1 b/Diff for: ‎boilerplate/_lib/subscriber-propose
-1
diff --git a/Diff for: ‎boilerplate/openshift/golang-osd-operator/.codecov.yml
+4 b/Diff for: ‎boilerplate/openshift/golang-osd-operator/.codecov.yml
+4
diff --git a/Diff for: ‎boilerplate/openshift/golang-osd-operator/README.md
+40-21 b/Diff for: ‎boilerplate/openshift/golang-osd-operator/README.md
+40-21
diff --git a/Diff for: ‎boilerplate/openshift/golang-osd-operator/app-sre-build-deploy.sh
+1-1 b/Diff for: ‎boilerplate/openshift/golang-osd-operator/app-sre-build-deploy.sh
+1-1
diff --git a/Diff for: ‎boilerplate/openshift/golang-osd-operator/app-sre.md
+11 b/Diff for: ‎boilerplate/openshift/golang-osd-operator/app-sre.md
+11
diff --git a/Diff for: ‎boilerplate/openshift/golang-osd-operator/build-opm-catalog.sh
+9-1 b/Diff for: ‎boilerplate/openshift/golang-osd-operator/build-opm-catalog.sh
+9-1
diff --git a/Diff for: ‎boilerplate/openshift/golang-osd-operator/codecov-secret-mapping
-62 b/Diff for: ‎boilerplate/openshift/golang-osd-operator/codecov-secret-mapping
-62
diff --git a/Diff for: ‎boilerplate/openshift/golang-osd-operator/configure-fips.sh
+18 b/Diff for: ‎boilerplate/openshift/golang-osd-operator/configure-fips.sh
+18
diff --git a/Diff for: ‎boilerplate/openshift/golang-osd-operator/csv-generate/catalog-build.sh
+25-2 b/Diff for: ‎boilerplate/openshift/golang-osd-operator/csv-generate/catalog-build.sh
+25-2
diff --git a/Diff for: ‎boilerplate/openshift/golang-osd-operator/csv-generate/catalog-publish.sh
+13-2 b/Diff for: ‎boilerplate/openshift/golang-osd-operator/csv-generate/catalog-publish.sh
+13-2
@@ -1,4 +1,4 @@
 build_root_image:
   name: boilerplate
   namespace: openshift
-  tag: image-v1.0.0
+  tag: image-v2.3.2
@@ -24,3 +24,7 @@ comment:
   layout: "reach,diff,flags,tree"
   behavior: default
   require_changes: no
+
+ignore:
+  - "**/mocks"
+  - "**/zz_generated*.go"
@@ -1 +1 @@
-image-v1.0.0
+image-v2.3.2
@@ -1 +1 @@
-b0a20637c47d7d94d6bdadbb2660b4f081526015
+f1ce2ebcab3cd03ddb7c46d1c8c96a810d5d5ca1
@@ -9,23 +9,26 @@ fi
 
 source ${0%/*}/common.sh
 
-CONTAINER_ENGINE=$(command -v podman || command -v docker)
+CONTAINER_ENGINE="${CONTAINER_ENGINE:-$(command -v podman || command -v docker)}"
 [[ -n "$CONTAINER_ENGINE" ]] || err "Couldn't find a container engine. Are you already in a container?"
 
-CONTAINER_ENGINE_SHORT=${CONTAINER_ENGINE##*/}
-
 # Make sure the mount inside the container is named in such a way that
 # - openapi-gen (which relies on GOPATH) produces absolute paths; and
 # - other go-ish paths are writeable, e.g. for `go mod download`.
 CONTAINER_MOUNT=/go/src/$(repo_import $REPO_ROOT)
 
 # First set up a detached container with the repo mounted.
 banner "Starting the container"
-if [[ $CONTAINER_ENGINE_SHORT == "podman" ]]; then
-		container_id=$($CONTAINER_ENGINE run --userns keep-id -d -v "$REPO_ROOT":"$CONTAINER_MOUNT":Z $IMAGE_PULL_PATH tail -f /dev/null)
+if [[ "${CONTAINER_ENGINE##*/}" == "podman" ]]; then
+    if [[ $OSTYPE == *"darwin"* ]]; then
+        CE_OPTS="--userns keep-id -v $REPO_ROOT:$CONTAINER_MOUNT"
+    else
+        CE_OPTS="--userns keep-id -v $REPO_ROOT:$CONTAINER_MOUNT:Z"
+    fi
 else
-		container_id=$($CONTAINER_ENGINE run -d -v "$REPO_ROOT":"$CONTAINER_MOUNT" $IMAGE_PULL_PATH tail -f /dev/null)
+    CE_OPTS="-v $REPO_ROOT:$CONTAINER_MOUNT"
 fi
+container_id=$($CONTAINER_ENGINE run -d ${CE_OPTS} $IMAGE_PULL_PATH sleep infinity)
 
 if [[ $? -ne 0 ]] || [[ -z "$container_id" ]]; then
   err "Couldn't start detached container"
 
@@ -7,7 +7,6 @@ declare -A SUBCOMMANDS
 SUBCOMMANDS=(
     # TODO:
     # [bootstrap]='Bootstrap a new subscriber'
-    # [codecov-secret-mapping]='Propose codecov secret mapping to openshift/release'
     # [prow-config]='Propose standardized prow configuration to openshift/release'
     [update]='Update an already-onboarded subscriber'
 )
 
@@ -24,3 +24,7 @@ comment:
   layout: "reach,diff,flags,tree"
   behavior: default
   require_changes: no
+
+ignore:
+  - "**/mocks"
+  - "**/zz_generated*.go"
@@ -14,6 +14,7 @@ This convention is suitable for both cluster- and hive-deployed operators.
 The following components are included:
 
 ## `make` targets and functions.
+
 **Note:** Your repository's main `Makefile` needs to be edited to include the
 "nexus makefile include":
 
@@ -28,7 +29,7 @@ following:
 ### Prow
 
 | Test name / `make` target | Purpose                                                                                                         |
-|---------------------------|-----------------------------------------------------------------------------------------------------------------|
+| ------------------------- | --------------------------------------------------------------------------------------------------------------- |
 | `validate`                | Ensure code generation has not been forgotten; and ensure generated and boilerplate code has not been modified. |
 | `lint`                    | Perform static analysis.                                                                                        |
 | `test`                    | "Local" unit and functional testing.                                                                            |
@@ -48,18 +49,26 @@ $ make RELEASE_CLONE=/home/me/github/openshift/release prow-config
 ```
 
 This will generate a delta configuring prow to:
+
 - Build your `build/Dockerfile`.
 - Run the above targets in presubmit tests.
 - Run the `coverage` target in a postsubmit. This is the step that
   updates your coverage report in codecov.io.
 
 #### Local Testing
+
 You can run these `make` targets locally during development to test your
 code changes. However, differences in platforms and environments may
 lead to unpredictable results. Therefore boilerplate provides a utility
 to run targets in a container environment that is designed to be as
 similar as possible to CI:
 
+```shell
+$ make container-{target}
+```
+
+or
+
 ```shell
 $ ./boilerplate/_lib/container-make {target}
 ```
@@ -72,27 +81,15 @@ By default it is configured to be run from the app-sre jenkins pipelines.
 Consult [this doc](app-sre.md) for information on local execution/testing.
 
 ## Code coverage
+
 - A `codecov.sh` script, referenced by the `coverage` `make` target, to
-run code coverage analysis per [this SOP](https://github.com/openshift/ops-sop/blob/93d100347746ce04ad552591136818f82043c648/services/codecov.md).
+  run code coverage analysis per [this SOP](https://github.com/openshift/ops-sop/blob/93d100347746ce04ad552591136818f82043c648/services/codecov.md).
 
 - A `.codecov.yml` configuration file for
   [codecov.io](https://docs.codecov.io/docs/codecov-yaml). Note that
   this is copied into the repository root, because that's
   [where codecov.io expects it](https://docs.codecov.io/docs/codecov-yaml#can-i-name-the-file-codecovyml).
 
-- A `make` target to [request the secret mapping in openshift/release](https://github.com/openshift/ops-sop/blob/be43125239deb1f2bbc1ef54f010410e97ff6146/services/codecov.md#openshiftrelease-pr-1---secret-mapping):
-
-```shell
-$ make codecov-secret-mapping
-```
-
-If you already have the openshift/release repository cloned locally, you
-may specify its path via `$RELEASE_CLONE`:
-
-```shell
-$ make RELEASE_CLONE=/home/me/github/openshift/release codecov-secret-mapping
-```
-
 ## Linting and other static analysis with `golangci-lint`
 
 - A `go-check` `make` target, which
@@ -107,13 +104,35 @@ The convention embeds default checks to ensure generated code generation is curr
 To trigger the check, you can use `make generate-check` provided your Makefile properly includes the boilerplate-generated include `boilerplate/generated-includes.mk`.
 
 Checks consist of:
-* Checking all files are committed to ensure a safe point to revert to in case of error
-* Running the `make generate` command (see below) to regenerate the needed code
-* Checking if this results in any new uncommitted files in the git project or if all is clean.
+
+- Checking all files are committed to ensure a safe point to revert to in case of error
+- Running the `make generate` command (see below) to regenerate the needed code
+- Checking if this results in any new uncommitted files in the git project or if all is clean.
 
 `make generate` does the following:
-* `operator-sdk generate crds` and `k8s`. This is a no-op if your
+
+- generate crds and deepcopy via controller-gen. This is a no-op if your
   operator has no APIs.
-* `openapi-gen`. This is a no-op if your operator has no APIs.
-* `go generate`. This is a no-op if you have no `//go:generate`
+- `openapi-gen`. This is a no-op if your operator has no APIs.
+- `go generate`. This is a no-op if you have no `//go:generate`
   directives in your code.
+
+## FIPS (Federal Information Processing Standards)
+
+To enable FIPS in your build there is a `make ensure-fips` target.
+
+Add `FIPS_ENABLED=true` to your repos Makefile. Please ensure that this variable is added **before** including boilerplate Makefiles.
+
+e.g.
+
+```.mk
+FIPS_ENABLED=true
+
+include boilerplate/generated-includes.mk
+```
+
+`ensure-fips` will add a [fips.go](./fips.go) file in the same directory as the `main.go` file. (Please commit this file as normal)
+
+`fips.go` will import the necessary packages to restrict all TLS configuration to FIPS-approved settings.
+
+With `FIPS_ENABLED=true`, `ensure-fips` is always run before `make go-build`
@@ -68,6 +68,6 @@ for channel in staging production; do
         echo "properly. Nothing to do!"
     else
         # build the CSV and create & push image catalog for the appropriate channel
-        make ${channel}-common-csv-build ${channel}-catalog-build ${channel}-catalog-publish
+        make ${channel}-csv-build ${channel}-catalog-build ${channel}-catalog-publish
     fi
 done
@@ -21,6 +21,17 @@ If not, you will need to set the `IMAGE_REGISTRY` environment variable (see [bel
 The SaaS bundle repository for `$OPERATOR_NAME` should be located at `https://gitlab.cee.redhat.com/service/saas-{operator}-bundle`, e.g. https://gitlab.cee.redhat.com/service/saas-deadmanssnitch-operator-bundle.
 Fork it to your personal namespace.
 
+If you have already forked it to your personal namespace and/or used your fork for testing app-sre scripts at some time in the past, it is recommended that you bring your fork in sync with how upstream appears, or else the catalog you test with may not work correctly when deployed.
+
+An example of how to do this for the `staging` branch is below (`production` steps are the same):
+
+```
+git checkout staging
+git pull upstream staging
+git reset --hard upstream/staging                
+git push origin staging --force                                                                            
+```
+
 ## Set environment variables
 ```bash
 # The process creates artifacts in your git clone. Some of the make targets
 
@@ -71,7 +71,7 @@ function check_bundle_contents_cmd() {
 # Check we are running an opm supported container engine
 function check_opm_supported_container_engine() {
     local image_builder=${1}
-    if [[ "$image_builder" != "docker" && "$image_builder" != "podman" ]]; then
+    if [[ "$image_builder" != docker* && "$image_builder" != "podman" ]]; then
         # opm error messages are obscure. Let's make this clear
         log "image_builder $image_builder is not one of docker or podman"
         return 1
@@ -320,6 +320,14 @@ function main() {
     local versions
     # shellcheck disable=SC2207
     versions=($(get_prev_operator_version "$bundle_versions_file"))
+    # This condition is triggered when an operator is built for the first time. In such case the
+    # get_prev_operator_version returns an empty string and causes undefined variables failures
+    # in a few lines below.
+    if [ -z ${versions+x} ]
+    then
+        versions[0]=""
+        versions[1]=""
+    fi
     local prev_operator_version="${versions[0]}"
     local prev_good_operator_version="${versions[1]}"
     local skip_versions=("${versions[@]:2}")
 
@@ -0,0 +1,18 @@
+#!/usr/bin/env bash
+
+set -e
+
+REPO_ROOT=$(git rev-parse --show-toplevel)
+CONVENTION_DIR="$REPO_ROOT/boilerplate/openshift/golang-osd-operator"
+PRE_V1_SDK_MANAGER_DIR="$REPO_ROOT/cmd/manager"
+
+if [[ -d "$PRE_V1_SDK_MANAGER_DIR" ]]
+then
+  MAIN_DIR=$PRE_V1_SDK_MANAGER_DIR
+else
+  MAIN_DIR=$REPO_ROOT
+fi
+
+echo "Writing fips file at $MAIN_DIR/fips.go"
+
+cp $CONVENTION_DIR/fips.go.tmplt "$MAIN_DIR/fips.go"
@@ -23,6 +23,13 @@ while getopts "o:c:r:" option; do
     esac
 done
 
+# Detect the container engine to use, allowing override from the env
+CONTAINER_ENGINE=${CONTAINER_ENGINE:-$(command -v podman || command -v docker || true)}
+if [[ -z "$CONTAINER_ENGINE" ]]; then
+    echo "WARNING: Couldn't find a container engine! Defaulting to docker."
+    CONTAINER_ENGINE=docker
+fi
+
 # Checking parameters
 check_mandatory_params operator_channel operator_name
 
@@ -56,13 +63,29 @@ EOF
 
 # Build registry
 cat <<EOF > $DOCKERFILE_REGISTRY
-FROM quay.io/openshift/origin-operator-registry:4.8.0
+FROM quay.io/openshift/origin-operator-registry:4.10.0 AS builder
 COPY $SAAS_OPERATOR_DIR manifests
 RUN initializer --permissive
+
+FROM registry.access.redhat.com/ubi8/ubi-micro:8.6-484
+
+COPY --from=builder /bin/registry-server /bin/registry-server
+COPY --from=builder /bin/grpc_health_probe /bin/grpc_health_probe
+COPY --from=builder /bin/initializer /bin/initializer
+
+WORKDIR /registry
+RUN chgrp -R 0 /registry && chmod -R g+rwx /registry
+
+USER 1001
+
+COPY --from=builder /registry /registry
+
+EXPOSE 50051
+
 CMD ["registry-server", "-t", "/tmp/terminate.log"]
 EOF
 
-docker build -f $DOCKERFILE_REGISTRY --tag "${registry_image}:${operator_channel}-latest" .
+${CONTAINER_ENGINE} build --pull -f $DOCKERFILE_REGISTRY --tag "${registry_image}:${operator_channel}-latest" .
 
 if [ $? -ne 0 ] ; then
     echo "docker build failed, exiting..."
 
@@ -41,6 +41,17 @@ BUNDLE_DIR="${SAAS_OPERATOR_DIR}/${operator_name}"
 OPERATOR_NEW_VERSION=$(ls "${BUNDLE_DIR}" | sort -t . -k 3 -g | tail -n 1)
 OPERATOR_PREV_VERSION=$(ls "${BUNDLE_DIR}" | sort -t . -k 3 -g | tail -n 2 | head -n 1)
 
+# Get container engine
+CONTAINER_ENGINE=$(command -v podman || command -v docker || true)
+[[ -n "$CONTAINER_ENGINE" ]] || echo "WARNING: Couldn't find a container engine. Assuming you already in a container, running unit tests." >&2
+
+# Set SRC container transport based on container engine
+if [[ "${CONTAINER_ENGINE##*/}" == "podman" ]]; then
+    SRC_CONTAINER_TRANSPORT="containers-storage"
+else
+    SRC_CONTAINER_TRANSPORT="docker-daemon"
+fi
+
 # Checking SAAS_OPERATOR_DIR exist
 if [ ! -d "${SAAS_OPERATOR_DIR}/.git" ] ; then
     echo "${SAAS_OPERATOR_DIR} should exist and be a git repository"
@@ -85,7 +96,7 @@ popd
 if [ "$push_catalog" = true ] ; then
     # push image
     skopeo copy --dest-creds "${QUAY_USER}:${QUAY_TOKEN}" \
-        "docker-daemon:${registry_image}:${operator_channel}-latest" \
+        "${SRC_CONTAINER_TRANSPORT}:${registry_image}:${operator_channel}-latest" \
         "docker://${registry_image}:${operator_channel}-latest"
 
     if [ $? -ne 0 ] ; then
@@ -94,7 +105,7 @@ if [ "$push_catalog" = true ] ; then
     fi
 
     skopeo copy --dest-creds "${QUAY_USER}:${QUAY_TOKEN}" \
-        "docker-daemon:${registry_image}:${operator_channel}-latest" \
+        "${SRC_CONTAINER_TRANSPORT}:${registry_image}:${operator_channel}-latest" \
         "docker://${registry_image}:${operator_channel}-${operator_commit_hash}"
 
     if [ $? -ne 0 ] ; then
Original file line number	Diff line number	Diff line change
`@@ -1 +1 @@`
`1`		`-b0a20637c47d7d94d6bdadbb2660b4f081526015`
	`1`	`+f1ce2ebcab3cd03ddb7c46d1c8c96a810d5d5ca1`
Original file line number	Diff line number	Diff line change
`@@ -7,7 +7,6 @@ declare -A SUBCOMMANDS`
`7`	`7`	`SUBCOMMANDS=(`
`8`	`8`	`# TODO:`
`9`	`9`	`# [bootstrap]='Bootstrap a new subscriber'`
`10`		`- # [codecov-secret-mapping]='Propose codecov secret mapping to openshift/release'`
`11`	`10`	`# [prow-config]='Propose standardized prow configuration to openshift/release'`
`12`	`11`	`[update]='Update an already-onboarded subscriber'`
`13`	`12`	`)`